Detections
Analytics

5.1.13 Ensure sshd post-quantum cryptography key exchange algorithms are configured

Information

OpenSSH has integrated post-quantum cryptography (PQC) to secure SSH connections against potential attacks from future quantum computers. This includes the adoption of hybrid key agreement algorithms that combine classical cryptographic methods with quantum-resistant ones.

PQC helps secure SSH connections against potential attacks from future quantum computers providing protection against both classical and quantum adversaries.

The combination of established classical algorithms with the forward-looking security of PQC algorithms, offers a robust solution during the transition phase to fully quantum-resistant cryptography.

Solution

Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line above any Include and Match statements.

Example:

KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Note:

 - First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.
 - If local site policy has stricter requirements, add any additional MACs that are not authorized by local site policy to the list in the example.

Impact:

A restrictive list of key exchange algorithms available to the SSH server may prevent some clients from being able to connect.

Including a non-supported key exchange algorithm in the kexalgorithms option, may prevent the SSH server from starting.

Note: The list of supported key exchange algorithms may also be obtained using the ssh -Q KexAlgorithms command.

See Also

https://workbench.cisecurity.org/benchmarks/24932

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: dba22bbbe727f596c1fef008aba0389bf782a6d669621178f60a391b45d0bd4e